Dns Rebinding in Actix with Hmac Signatures

To mitigate DNS Rebinding risks in Actix when using HMAC Signatures, ensure that hostname validation is performed independently of DNS resolution and that HMAC verification is applied consistently on every request. Do not rely on the Host header alone for authorization; instead, validate the target hostname or IP against an explicit allowlist and recompute HMAC verification per request.

Below is a concrete, working example in Rust using Actix-web and the hmac crate. The code demonstrates secure HMAC verification with strict hostname validation before processing a request.

use actix_web::{web, HttpRequest, HttpResponse, Result};
use hmac::{Hmac, Mac};
use sha2::Sha256;
use std::collections::HashSet;

// Define a type alias for HMAC-SHA256
 type HmacSha256 = Hmac;

// Allowed hostnames to prevent DNS rebinding
const ALLOWED_HOSTS: &[&str] = &["api.trusted.example.com"];

fn verify_hmac_signature(req: &HttpRequest, body: &[u8]) -> Result {
    // Retrieve headers needed for HMAC verification
    let maybe_signature = req.headers().get("X-API-Signature");
    let maybe_api_key = req.headers().get("X-API-Key");

    let signature = match maybe_signature {
        Some(val) => val.to_str().map_err(|_| actix_web::error::ErrorBadRequest("Invalid signature header"))?,
        None => return Ok(false),
    };

    let api_key = match maybe_api_key {
        Some(val) => val.to_str().map_err(|_| actix_web::error::ErrorBadRequest("Invalid API key header"))?,
        None => return Ok(false),
    };

    // Compute HMAC over method, path, and body using the API key as the secret
    let mut mac = HmacSha256::new_from_slice(api_key.as_bytes())
        .map_err(|_| actix_web::error::ErrorInternalServerError("HMAC initialization failed"))?;
    let method = req.method().as_str();
    let path = req.path();
    mac.update(method.as_bytes());
    mac.update(path.as_bytes());
    mac.update(body);

    // Decode the provided signature (assumed to be hex-encoded)
    let computed_signature = hex::decode(signature)
        .map_err(|_| actix_web::error::ErrorBadRequest("Invalid signature encoding"))?;

    // Verify in constant time
    if mac.verify_slice(&computed_signature).is_ok() {
        Ok(true)
    } else {
        Ok(false)
    }
}

async fn protected_handler(req: HttpRequest, body: web::Bytes) -> Result {
    // Validate hostname against allowlist
    let host = match req.headers().get("Host") {
        Some(h) => h.to_str().unwrap_or(""),
        None => return Ok(HttpResponse::BadRequest().body("Missing Host header")),
    };

    if !ALLOWED_HOSTS.contains(&host) {
        return Ok(HttpResponse::Forbidden().body("Hostname not allowed"));
    }

    // Verify HMAC signature
    let is_valid = verify_hmac_signature(&req, &body)?;
    if !is_valid {
        return Ok(HttpResponse::Unauthorized().body("Invalid HMAC signature"));
    }

    // Proceed with business logic
    Ok(HttpResponse::Ok().body("Request authenticated"))
}

In this example, the service does not trust the resolved IP address and re-validates the hostname on every request using an allowlist. The HMAC is computed over the HTTP method, path, and body, ensuring that any modification to the request changes the signature. By combining strict hostname validation with per-request HMAC verification, the risk of DNS Rebinding bypassing authentication is substantially reduced.

When using middleBrick, you can scan your Actix endpoints to confirm that Host header validation and HMAC checks are consistently applied. The tool provides prioritized findings with severity and remediation guidance, helping you address issues such as missing hostname verification or inconsistent signature usage. Plans such as the Pro tier include continuous monitoring and GitHub Action integration to catch regressions in CI/CD pipelines.